DarkSword Spyware and How to Stay Protected from It

Browsing news on your iPhone and sipping a cup of coffee while having snacks. Doesn't it look like harmless fun? What if I say that an invisible code has slipped into your iPhone like a burglar to steal your data? That is how simply DarkSword Spyware can affect your device. This spyware grabs your photos, texts, passwords, and even crypto wallet details without leaving a trace or requiring you to click on anything.

With millions of iPhones at risk globally, it is a wake-up call for iPhone users that even Apple's fortress is not invincible. Tech enthusiasts know it is a JavaScript beast exploiting six flaws in one go, but the real concern is data theft, wiping, and leaving no trace. In this article, we will break down how it works and how you can protect your iPhone from it.

Also read || Stryker Hack: 200K Devices Wiped

What is DarkSword Spyware, and how does it work?

DarkSword is a specialized type of spyware designed for targeted digital surveillance and data exfiltration. Unlike common malware that spreads indiscriminately, DarkSword is deployed through "watering hole" attacks on compromised legitimate websites. Once a vulnerable device visits an infected page, DarkSword silently operates in the background.

DarkSword steals private communications and captures sensitive credentials, including Wi-Fi passwords, messages, and cryptocurrency keys, from over 50 apps. The primary goal of DarkSword is to remain undetected for extended periods through hit-and-run operations, enabling attackers to harvest information without leaving traces.

DarkSword exploits six specific vulnerabilities in iOS to gain root privileges (CVE-2025-31277, CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, CVE-2025-43520). This allows it to bypass security measures and stage stolen data in /private/var/tmp/ for transmission over HTTP to attacker-controlled servers such as sqwas.shapelie.com.

Also read || The Psychology Behind Cybersecurity: How cyberconIQ Tackles Human Cyber Risk

Decoding DarkSword mechanism and who is affected by it?

DarkSword uses a "watering hole" mechanism in which attackers compromise legitimate websites, such as Ukrainian news sites like novosti.dn.ua and government portals like 7aac.gov.ua. When you visit these sites using a vulnerable Safari browser on iOS 18.4 through 18.6.2, the spyware triggers a sophisticated zero-click exploit chain and gets deep kernel access.

The primary victims of DarkSword are iPhone users running iOS 18.4 through 18.6.2, with approximately 221 million devices worldwide vulnerable due to delayed software updates. Real-world campaigns heavily target individuals in Ukraine, while other actors hit Saudi Arabia, Turkey, and Malaysia. High-profile journalists and activists face the highest risk, though any unpatched user visiting infected pages could be affected.

Also read || UK Cybersecurity Bill Advances + Executive-Level NIST 2.0 Self-Assessment

The Origins of DarkSword Spyware

First identified in March 2026 by researchers at iVerify, Lookout, and Google, DarkSword is linked to a suspected Russian proxy known as UNC6353. The spyware features unobfuscated JavaScript code hosted on Estonian servers, such as cdncounter.net, suggesting that developers used AI tools to build it quickly before selling exploits to various hacking groups worldwide.

The threat has expanded as other groups repurposed the code. UNC6748 (Saudi-linked) used Snapchat-themed lures while PARS Defense deployed variants like GHOSTKNIFE in Turkey and Malaysia. This shows how elite spyware becomes a tool for both state-sponsored espionage and financial theft, targeting government intelligence and redirecting it to cryptocurrency wallets.

Also read || The Top 10 Worst Computer Viruses in History

Current Vulnerabilities and Defense Strategies

The Cybersecurity and Infrastructure Security Agency (CISA) has added DarkSword's specific flaws to its Known Exploited Vulnerabilities list as of March 24, 2026. To protect 221 million phones still running unpatched iOS 18.4-18.6.2, Apple released critical fixes in iOS 18.7.3 and later. Many users remain at risk without updates, allowing the spyware to bypass security and steal messages, photos, and credentials silently.